topic Re: Show the time range of a search in HH:MM in a table in Splunk Search

Show the time range of a search in HH:MM in a table

chadman — Wed, 10 Aug 2016 17:34:59 GMT

I would like to show the HH:MM of my search as a field in a table. How can I set that up as a field?

chadman — Wed, 10 Aug 2016 17:36:52 GMT

actually displaying this in seconds would work better.

sundareshr — Wed, 10 Aug 2016 17:38:03 GMT

Like this

your base search | eval time=strftime(_time, "%H:%M") | table _time time

*UPDATED based on comment*

your base search | addinfo | eval duration=info_max_time-info_min_time | eval dur_formatted=tostring(duration, "duration") | table dur*

sundareshr — Wed, 10 Aug 2016 17:40:04 GMT

So you want to display the duration of the search? Are you displaying it in a dashboard?

chadman — Wed, 10 Aug 2016 17:47:43 GMT

So if I do a search from 8AM to 9AM I would like to see the difference in seconds, 3600

sundareshr — Wed, 10 Aug 2016 18:01:19 GMT

Aha.. see updated answer below..

chadman — Thu, 11 Aug 2016 14:29:15 GMT

Perfect! That worked great!